In a rare move, the Department of Health and Human Services (HHS) has issued a warning to hospitals and health systems to prioritize the patching of a two-year-old vulnerability in picture archive communication systems (PACs). PACs are used for the exchange and storage of health scans and images, such as MRIs, CT Scans, breast imaging,
Department of Health and Human Services
Excellus Health Plan Pays $5.1M to OCR in Settlement Following Data Breach
By Linn Foster Freedman on
Posted in Data Breach
The U.S. Department of Health and Human Services Office for Civil Rights (OCR) recently announced that it had entered into a Resolution Agreement, Corrective Action Plan, and settlement with Lifetime Healthcare, Inc., the parent of Excellus Health Plan, over alleged violations of HIPAA relating to a data breach that occurred from December 23, 2013 through…
HHS Finalizes Joint Rules on Electronic Health Record Interoperability and Access
By Guest Contributor on
Posted in Health Information Privacy
On March 9, 2020, the Department of Health and Human Services (HHS) announced final rules seeking to give patients more access to, and control of, their health data. The final rules were issued by the Office of the National Coordinator for Health Information Technology (ONC) and Centers for Medicare and Medicaid Services (CMS). The ONC…
HHS Increases Civil Monetary Penalties under HIPAA
By Jean Tomasco on
In accordance with the Inflation Adjustment Act, the Department of Health and Human Services (HHS) has updated its regulations to reflect required annual inflation-related increases to civil monetary penalties, including those for certain violations of HIPAA’s “administrative simplification” provisions. The final regulations became effective on November 5, 2019, the date they were published in the…
For First Time Ever, Government Brings HIPAA Enforcement Action Alleging Violations of Right to Access Medical Records
By Conor Duffy on
On September 9, 2019, the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced that it had settled its first ever HIPAA enforcement action arising from alleged violations of the individual right to access health information under HIPAA. OCR entered into a settlement with Bayfront Health St. Petersburg (Bayfront) in response…
HHS Issues Limited Waiver Following Hurricane Florence
By Linn Foster Freedman on
Posted in HIPAA and Health Information
As Hurricane Florence was making landfall, Department of Health and Human Services Secretary Alex Azar issued HIPAA guidance that outlined when hospitals in declared state of emergency areas can qualify for a waiver of certain provisions of the HIPAA Privacy Rule, including fines and penalties.
According to the guidance, “the HIPAA Privacy Rule allows patient…
Ciox Health, LLC Initiates Lawsuit against the Department of Health and Human Services Over Medical Records Request Fees under HIPAA and HITECH
By William Daley on
Posted in Enforcement + Litigation
On January 8, 2018, Ciox Health, LLC (Ciox) filed a complaint against the Department of Health and Human Services (HHS) and then-acting Secretary Eric D. Hargan, alleging that the Department’s rules and guidance, under HIPAA and HITECH, “impose[] tremendous financial and regulatory burdens on health care providers and threatens to upend the medical-records industry that…
Business Associate Resold Fax Machine Containing PHI
By Linn Foster Freedman on
Posted in HIPAA and Health Information
Fax machines are still used in the medical community, and these days, faxing may be more secure than emailing as hackers have not yet cracked the task of hacking into old fax machines. All kidding aside, fax machines have been, and continue to be a risk to organizations as they have the ability to store…
Drones Delivering Medical Supplies in East Africa but not in U.S.
By Linn Foster Freedman on
Posted in Drones
Residents in remote areas of Tanzania and Rwanda in East Africa are receiving medical supplies through the use of drones, far surpassing similar efforts in the U.S., according to Robert Graboyes, a senior research fellow at George Mason University.
In Rwanda alone, according to RealClear Health, drones have delivered 2,600 units of blood and have…
What is the HIPAA Complaint Process?
By Pamela Del Negro on
Posted in HIPAA and Health Information
The U.S. Department of Health and Human Services Office for Civil Rights (OCR) is responsible for enforcing the HIPAA Privacy and Security Rules. Any person who believes that a covered entity or business associate is not complying with HIPAA may file a complaint with OCR (complaints may also be submitted directly to a covered entity). Here is a high-level overview of the OCR complaint process from intake and review through investigation and resolution:
Intake and Review. During this step, OCR reviews the complaint to determine whether it can or will take action. OCR may take action on a complaint if it meets the following conditions:…
Continue Reading What is the HIPAA Complaint Process?